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NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 

FORT GEORGE G. MEADE, MARYLAND 207S5-6000 


30 November 2010 


MEMORANDUM FOR THE CHAIRMAN, INTELLIGENCE OVERSIGHT BOARD 

THRU: Assistant to the Secretary of Defense (Intelligence Oversight) 

SUBJECT: (UA'FOUO) Report to the Intelligence Oversight Board on NSA Activities - 
INFORMATION MEMORANDUM 

(UZ/ TOUO) Except as previously reported to you or the President, or otherwise stated in 
the enclosure, we have no reason to believe that intelligence activities of the National Security 
Agency during the quarter ending 30 September 2010 were unlawful or contrary to Executive 
Order or Presidential Directive and thus should have been reported pursuant to Section 1.6(c) of 
Executive Order 12333, as amended. 

(U//TOUO)"The Inspector General and the General Counsel continue to exercise oversight 
of Agency activities by inspections, surveys, training, review of directives and guidelines, and 
advice and counsel. These activities and other data requested by the Board or members of the staff 
of the Assistant to the Secretary of Defense (Intelligence Oversight) are described in the enclosure. 


GEORGE ELLA^ 
Inspector General 


(b)(3)-P.L. 86-36 


MATTHEW G. OLSEN 
General Counsel 


(U//FOUO) I concur in the report of the Inspector General and the General Counsel and 
hereby make it our combined report. 


KEITH B.ALEXANPBR 
General, U. S. Army 
Director, NSA/Chief, CSS 


Enel: 

Quarterly Report 

This document may be declassified and marlced 


upon removal of enclosure(s) 


roved for Release bv NSA on 12-19-2014. FOIA Case # 70809 
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TOP SCCRCT COMINT NOFO tW 


I. (U) Intelligence, Counterintelligence, and Intelligence-Related Activities that 
Violate Law, Regulation, or Policy and Were Substantiated during the Quarter, as 
well as Actions Taken as a Result of the Violations 

A. (U) Intelligence Activities under Executive Order (E.O.) 12333 Authority 

(U) Unintentional Collection against U.S. Persons or Foreign Persons in the 
United States 


(S ' R g L ' TO UfiA. rVCY) In this quarter, there were I l instance.s in which Signals Intelligence 
(SIGINT) analysts inadvertently targeted or collected communications to. from, or about US. 
persons while pursuing foreign intelligence tasking. All intercepts and reports have been deleted 
or destroyed as required by United States SIGINT Directive (USSID) SP00I8. 


1- (U) Targeting 


.(b) (1) 
lb) {3)-P.L. 


86-36 


(TS ' Vrd/i ' MZL TO I' i iA. TH LY ) [ 


an NSA analyst discovered that a telephone 


selector for a valid foreign intelligence target remained tasked while t he taruet was in t he United 
States. The tasking error occurred because information that the target ] ^ t he United 

The selector w as detasked on ] ~| 
The target departed the 


States on]_jwas not properl y communicated. 

J There was no collection between I 


United States oi^ 


] an NSA analyst discovered that a selector for a 


(TGi‘/Gli'/RCL TO USA. fXTV ) I 

valid foreign intelligence target remained tasked while the target was in the United States. The 
tasking error occurred because the analyst overlooked the target 's selector on a list of selectors to 
be detasked, There was no collection from 


the period of the visit. 


T TS//RLL TOUGA. rVCV) | I 

NSA analysts discovered that they had tasked telephone selectors associated with U.S. persons 
The tasking errors occurred because information identifying that the selectors were associated 
with U.S. persons was not included in the source information when the selectors were tasked. 

All collection was deleted, and no reports were issued. . 

(b) {3)-P.L. 86-36 

fTS//S I //RCL TO UGA. rVTY) i I an NSA analyst discovered that an e-mail 

selector for a valid foreign i ntelligence target remained tasked while the target was in the Uni ted 
States. Altho ugh the analyst ! | the United States on □ 

_ the tasking error occurred because the analyst erroneously believed that the 

selector would be detasked by another team. The selector was detasked | 1 All 

collection was deleted, and no reports were issued. 


•ffG/ZGlZ/NF) I I an NSA analyst discovered that telephone selectors for a 

valid foreign intelligence target (tasked under E.O. 12333) remained tasked while the target was 
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(k>) (1) 

(bK(3)-P.L. 86-36 
(b) (3.)-18 use 793 
(b)(3)\50 use 3024(i) 


in the Unit ed States froinl 
overlooked 


The tasking error occurred because the analyst 


No collection resulted from the taking. Because the discovery was made after 


] 


the target departed the United States, the target’s selectors were not detasked. 


(9//RCL TOU9A. FVXV) 


NSA analysts discovered that 


selectors for valid foreign intelligence targets remai ned tasked while the targets w ere in the 
United States. The tasking errors occurred because[~ |was not being 


reviewed on a regular basis. Because the discoveries were made after the targets departed the 
United States, the taraets’ selectors were not detasked. 

(b)(1) 

(b)(3)-P.L. 


(b) (1) 

(b)(3)-P.L. 


86-36 


2. (U) Database Queries 


86-36 


(b)(3)-50 use 3024(i) 


(9//MIL TO USA. rVTV) On| loccasions. analysts performed overly broad or poorly 
constructed database queries that potentially targeted U.S. persons. For example, these queries 


\ that produced imprecise results. On I bf those occasions, the queries returned results 
from the database. The query results were deleted, and no reports were issued. Procedural errors 
contributed to the followina incidents. 


/ i y^ ' 3l//RCL TO USi\. r^^EY)[ 


a SIGINT analyst queried a raw 
traffic database using telephone selectors associated with a valid foreign intelligence 
target when th e target was kn own to be in the United States. The analyst self-reported 
the incident on ^ to an auditor, who also noticed the query. All results were 

deleted, and no reports were issued. 

(S//REL TO USA. FVEY) On l l occasions between^ 


NSA analysts queried raw traffic databases using selectors associated with U.S. persons. 

The analysts neglected to perform the required research on the selectors befbre^j^^ 

performing the queries. All results were deleted (b)(3)-p.L. 86-36 


/ (S//SI//aCL TOUGA. rvcv ) [ 


~| a SIGINT analyst queried a raw traffic 
database with telephone selectors associated with a valid foreign intelligence target using 
dates during which the target was in the United States. After submitting the query, the 
analyst recalled that the target had been in the United States during the range of dates 
submitted. All results were deleted, and no reports were issued. 


/ (9//91//RCL TOU3A. r\TV)[ 


an NSA analyst 


continued to query a raw traffic database using selectors associated with a valid foreign 
intelligence target known by the analyst to be in the United States during this period. The 
analyst misunderstood the procedures for querying selectors in a raw traffic database. 

The queries did not return any results. 


/ (3//91//RCL TOU5A. 


an NSA analyst discov ered thatf 


. while th at target was in the United States, 
an NSA analyst received information F 


Jdet asked 


(b) (1) 

(b)(3)-P.L. 86-36 


TOP SCCR£T//COMlffT/;?jOrORJJ 
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tfel(l) 


the selectors! 
failed to[ 


ctorsC 

)| 


a result, traffic continued to be retrieved during this period 
results from the queries once the error was discovered ] 
issued. 


]the Unite d Stales. The analyst 
]the United States. As 


The analyst deleted all 

I No reports were 


•L. 86-36 r 

/ (TS//Sl/ymiL TO USA. FVEY) [ 


NSA analysts initiated 


queries in a raw traffic database using e-mail selectors associated with the same valid 
foreign intellig ence target without realizing that the target was in the United States as of 
I The error occurred because the target’s travel to the United States was not 

properly c ommunicated within t he analyst’s office All results from the queries were 
deleted on| | and no reports were issued. 


/ (TS//S1//P.EL TO USA. F\^'EY 


an NSA analyst queried raw 


traffic databases using telephone selectors associated with a valid foreign intellige nce 
target that had been detasked because ofthe target's arrival in the United States on l I 
I I The error occurred because the target’s arrival was not properly 

communicated within the office. All results were deleted, and no reports were issued. 


(T3//3 I //RCL TO UGA. fVCY) An NSA analyst failed to | l in a 

raw traffic database for telephone selectors ass ociated with I Ivalid foreign intelligence 
targets who were in the United States between | j 


were deleted 


J before departing ove rseas for temporary duty. The Queries and all results 

and no reports were issued. 


B. (U) Dissemination of U.S. Identities 


(TS i VS I '/RCL UD."K. rvCV ) The NSA Enterprise issued I j SIGlNT product reports during 
this quarter. In those repo rts. SIG INT analysts disseminated communications to. from, or about 
U.S. persons or entities on I I occasions while pursuing foreign intelligence tasking. In a 
total ofT"! SIGINT pr oducts, such disseminations were found to be improper and the reports 
were canceled as NSA | [ analysts learned of U.S. persons, organizations, 

or entities named without authorization. All data in the canceled reports was deleted as required, 
and the reports were not reissued or were reissued with proper minimization. 

C. (U) The Foreign Intelligence Surveillance Act (FISA) 

1. (U) NSA/CSS Title I FISA 

a. (U) Tasking Error 

an NSA analyst discovered that f [ selector 

;ing and collection under an N SA Foreign Intelligence Surveillance Court 
(FISC) Order was | ~| not a valid foreign intelligence target as was 

originally believed. The telephone selector was included in NSA’s FISA application in error. 


(TS//Sl//Mr) On 
authorized for tas 


(b) (1) 

(b)(3)-P.L. 


86-36 


TOP SCCrU:T//CONOfn'//><OrOR>f 
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Xb) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 


The selector was detasked on] 
(b)(1) issued. 

(bK3)-P.L. 86-36 

■ffS'/sii'fMaf 


All collection was purged, and no reports were 



(TS//Sl/i'MF) r 


while collecting against a 


authorization. L 


1 pursuant to an NSA FISC Order, NSA targeted, without 


All collection will be purged, and no reports were issued. 


an NSA analyst discovered that[ 


]by a valid tbreign intelligence target in the United States were tasked with out p roper 


S I 

jspecified that onlyL 


[ authorized under the order could be taske d. The previous order allowed collection and 
tasking of] I Not all members ofthe j [cou ld be proved t o be 

[ [ authorized under the order. 


I 


Jwere detasked 


All queries and results weredeleted. and no reports were issued. 


2. (U) FISA Amendments Act (FAA) 


a. (U) Section 702 

i. (U) Unauthorized Targeting 

(TS /j ' Gl/mCL TO UG.K. r\TV) 


(b) (1) 

(b) (3)-P.L. 86-36 
(b) (3)-50 use 3024(i) 


. (b) (1) 

./ (b) {3)-P.L. 86-36 


an NSA analyst used outdated information to 


task a selector for an FAA §702-authorized target. The selec tor was detasked on! 
A purge request is pending for all FAA §702 collection frornj [ 


(S//aCL TO USA. FVGY) On[ 


verifications to task a selector. NSA discovered the error oi~| 
detasked the same day. No collection occurred from j 


an NSA analyst used outdated foreignness 


and the selector was 


(TS//S I7REL TO UGj\. r\ ' TY) On [ b ccasions between^ 


□□ NSA analysts discovered that selectors for valid foreign intelligence targets remained 
tasked while the targets were in the United States. The errors occurred because information 
revealing the targets' travel to the United States was not reviewed. A purge request is pending 
for all FAA §702 collection when the targets were in the United States. 


(TG//GI//RFL TO USA. FVFY) [ 


NSA discovered that an individual 


believed to be a valid foreign intelligence target was a U S. person. The err or occurred because 
information revealing the target’s U.S. citi zenship was not review ed. e-mail selectors 
associated with the target were detasked on ~j A pu rge request is pending for 

all FAA §702 collection j 


T O P SECRETiVCQMnfT/ifNOFORM 
4 
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(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 


(TS/ZS t /ZREL TO USA. r\ ' TV) 


an NSA analyst discovered that the 


selectors associated with a v alid foreimi intellige nce target remained tasked when the target 
entered the United States on_ 


the United States 


Althoug h the analyst was aware of the target’s 
the analyst incorrectly believed that an 


NSA FISC Order allowed the target to remain on l- AA ^ /02 tasking while the target was in the 
United States. After realizing the error, the analyst detasked the selectors A purge request for 
FAA §702 collection! I ^nd no reports were issued. 


(U) Database Queries 


(b) (1) 

(b) (3)-P.L. 


86-36 


(T3//gh7?>JP) ,_ 

associated with a U.S. personL 


1 an NSA analyst performed I Q uer ies on a selector 
j raw traffic database. 


containing FAA §702-derived data. The analyst was unaware tirat the target was a U.S. person 
previously targeted under §704 and §705b authorizatio n and failed to vy itV the selector before 
querying. The analyst deleted the query and results oiJ 


] 


(U) Tasking Error 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(T S /)' S 1//REL TO USA. FVFY) [ 


]nSA analysts discovered 


that the selectors tor valid foreign intelligence targets had been dual routed to an Intelligence 
Community customer under the incorrect FAA §702 certification. The selectors were detasked. 
and a purge request is pending for all data collected under the incorrect certification. 


] NSA analysts discovered that, as a result of a 


iv. (U) Detasking Delays 

(Tri'/ril'/RCL TOUfjA. r\XY| | 

system tasking problem, collection auainst an F.AA §702-authorized target continued | j days 
after the selector was detasked. On I I the cause of the system taski ng problem was 

identified and corrected. The problem affected ! j other selectors. All ] ! selectors have 
been properly detasked. All FAA §702 collection associated with this problem has been marked 

for deletion. (b) (i) 

_ (b)(3)-P.L. 86-36 

(TS//SI//PlCL to USA. r\T -¥l ! ! NSA attempted to 

mail selectors associated with a valid foreign intelligence target; however, detas^ 
unsuccessftil and collection continued for i l additional days. NSA has submitted a destruction 
waiver to retain specific tr affic from one of the selec tors. A purge request is pending for all 
other FAA §702 collection ! ! No reports based on data collected while 

the taruet was in the United States were issued. 


Jdetask □e- 
skimi was 


(TS « S I « P. F L TO USA. FV R¥»[ 


NSA discovered that as a result of a 


] the selectors for FA A §702- authorized targets 

were not fullv detasked durina the transition from FAA certification j |to FAA certification 


After the error was corrected, detasking was completed onj j 


(b)(1) 

(b)(3)-P.L. 


86-36 


TOP SECRET//COM]f»rT//f40rORJ ’ J 


(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 
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(TS//S1//REL TO USA. FVEY)[ 


[collection continued on a selector tasked 


for a valid foreian intelligence taraet while that taraet was in the United States on 


NSA a nal\sts overlooked ! _ 

_for the selector. A purge request is pending tor all FAA ^702 collection from 


b. (U) Section 705b 
i. (U) Detasking Delays 


'(b)(1) 

(b) (3)-P.L. 86-36 


(ts^'SI'TlCL TOi'^A rvcYr'^-^i 

NSA flnnlv«5f<5 Hi«:rnv/»rpH that flip <;p|prfnr« 

for an FAA ^705b-authorized target remained taskec 

after the authorization had expired] j 

1 ir- 

1 1 he selectors were detasked oi 

1 1 here was no collection. 


D. (U) Other 

1. (U) Unauthorized Access 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i; 


(U//Fe UO) - On 


NSA forwarded FISA-derived 


.. • (b)(3)-P.L. 86-36 


information in e-mails to NSA analysts not cleared for FISA access. Upon discovery ofthe 
error, the e-mails were recalled and deleted. 


authorized access to FISA data from [_ 

had the required FISA access in a previous job until[ 


NSA determined that an NSA staff officer did not have 

I Although the staff officer 


access ha d not been restored to r 


the current job. The staff officer was subsequently approved for access on 

NSA discovered thatf 


(G)MflCL TO USA. FVCV) 

was accessing raw SIGINT databases from an unauthorized, secure 
NSA/CSS reminded the( 


Jfacility. 


Jnalyst 


to personnel, missions, and facilities approved for access 
Cb)(1) 

(b)(3)-P.L. 86-36 


]that access to NSA raw SIGINT databases is granted only 


(b) (1) 

(bl(3)-P.L. 86-36 
(b) (3)-50 use 3024(i) 


2. (U) Data-Handling Errors 


(TS//SI//Nr) [ 


NSA FISC Ord^ 
data was purged on 


an NSA analyst discovered FISA information collected under an 

~l The 


The analyst who received notice ofthe incident and 


requests to purge the data was on extended temporary duty and did not read his e-mail until he 
returned in 


(TSVSlvREL TOUS.V fVCY) On 


NSA analysts forwarded to a 


TOP 3ECRET//COMIffTi NOFORN 
6 



DbOGID: 4165213 

(b-i (5 j -f. L. 86-56 
(b)>(.,3)-50 use 3024 (i) 


I I analyst FAA $702-aulhorized traffic that included an unminimized reference to a U.S. 
person ’s identity. NSA requested that the traffic be purged from its databases, aiid j | 

I lanalysi confirm ed that this had occurred. NSA re-forwarded the properly minimized traffic 
to the! I 


3. (U) Consensual and Other Collection 'Tbi(i) 

(b)'f3)-P.L. 86-36 

(T S //Sl//PiEL TO USA. F\' E V) | | an NSA analyst queried a raw traffic database 

using a U.S. person’s telephone selector outside the DlRNSA-authorized period to query and 
task the selector. DIRNSA had authorized collection on telephone selectors associat ed withj 
U.S. hostaues . The authorization all owed tasking and q uerying on the selectors from i I 

I I forward but not before. I Ian NSA analyst queried one of the _ 

telephone selectors using a date range | ~ 

j The analyst deleted the query and the results I I No reports based on 

the query results were issued. 


agreement from 


I The selector was detasked 


an NSA analyst discovered that a consensual collectioii_ 

p iad expired. The selector r emained tasked on j | 

'as detasked | I and there was no coTTection. 


(b)(1) 

(b) (3)-P.L. 86-36 


4 (U) Unauthorized Collection of COMSEC Monitoring Data (b) <3)-p. 

''fB;)'13)-P.L. 86-36 _ __ 

(U/ /FOUO) ' Onj_!■ NSA/CSS analys ts discovered that a system problem allowed 

collection on | outside of t he authorized technical data provided by 

the customer. An upgr ade to software during ] is beli eved to have caused the system to 

I \ The problem was fixed on | | All unauthorized collection will 

be removed 


(U//P QUO) On| | NSA analysts discovered that a system problem allowed 

collection on j beyond the authorized period to monitor. All unauthorized collection 

was deleted. A manual fix to prevent the problem from recurring was put in place. 


5. (U) Computer Network Exploitation (CNE) 






DOCID: 4165213 


'tb) (1) 

(b>-.(3)-P.L. 86-36 
(bif3)-13 use 793 
(b)(3)-50 use 3024(i) 






E. (U) Counterintelligence Activities 
(U) Nothing to report. 

F. (U) Intelligence-Related Activities 


(b) (1) 

(b) (3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


^G//DI,','NrrTo reduce the risk of unauthorized telephony collection and prevent violatio ns. NSA 
instituted a process that uives analysts ureater and faster insiulit into a target’s location. I I 


I When collection did occur, data 

was purged from NSA's principal raw tratTic repositories when required. (b) (i) 


(b)(3)-P.L. 86-36 
■-P use 3024(i) 


I NSA analysts found i ie-mail selector s j 

{ ms quarter. When collection occurred, it was 
purged from NSA/C'SS’s principal raw traffic repositories when required. 


(b) (1) 

(b)(3)-P.L. 86-36 


$ 
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(b)(1) 

(b)(3)-P.L. 86-36 


(U//rOUO) Although not violations ofE.O. 12333 and related directives. NSA/CSS reports I I 
instances in which database access was not terminated when access was no longer required. 

Once identified, the accesses were terminated In addition, there were I l instances of 
unauthorized access to raw SIGINT during the quarter. 

(T6//61//11CL TO UGA. rVi:V) | ib) (i) i 

j-36 

798 

3024(i) 


II. (U) NSA/CSS Office of the Inspector General (OIG) Intelligence Oversight (10) 
Inspections, Investigations , and Special Studies 


(U/ /FOUO) During this quarter, the OIG reviewed various intelligence activities ofNSA/CSS to 
determine whether they had been conducted in accordance with statutes. Executive Orders. 

Attorney General procedures, and Department of Defense (DoD) and internal directives. With 

few exceptions, the problems uncovered were routine and showed that operating elements 

understand the restrictions on NSA/CSS activities. (b) (3)-p.l. 86-36 

A. (U) Cryptologic Support Group (CSG)_ 

(U//FOUQr^'SG r I had no documented procedures for accomplishing 10 training of | 1 
SIGINT personnel and for completing 10 quarterly reporting. While the CSG Chief was 
designated as the 10 Officer (100). no alternate 100 was designated. During the CSG Chiefs 
extended absence, the site had no official 10 point of contact. An alternate 100. who was 
designated before the inspection began, is drafting standard operating procedures for 10 training 
and for incident and quarterly reporting. 


B. (U) 


(b)(3)-P.L. 86-36 


(U/ /rOUO) The l l lO program has improved significantly since the 2007 inspection. The 10 
Program Manager (PM), now a full-time employee, has been in the position for four years, 
providing continuity for the site’s 10 program. The site's 10 processes and procedures have 
been shared as a best practice with 10 PMs throughout the extended enterprise. To assist in 
handling increased oversight responsibilities, the 10 PM delegated certain 10 functions to 
experienced personnel in key mission areas where there is risk for exposure to U.S. person 
information. Despite the delegation of functi ons. the 10 PM does not have an officially 
designated alternate, creating a single point of failure. This was noted as a program weakness in 
previous inspections in 2004 and 2007. The OIG will track corrective actions. 


C. (U) Misuse of the U.S. SIGINT System 


(U) Nothing to report. 


TOP GCCRET//COMIFfT//NOrOIl>J 
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(b)(1) 

(b) (3)-P.L. 36-36 

D. (U) Congressional and Intelligence Oversight Board Notifications (b) (3)-so use 3024 (i) 

(b)(3)-P.L. 86-36 


(TO/ZGIZ/MD 


NSA/CSS provided an update to the Congressional 


intelligence committees on the continuing efforts to improve and refine its data puruina process 



NSA is working on immediate and long-term solutions to 


tliese problems. This matter was reported to the FISC 
notification is enclosed 


A copy of the 


(b)(3)-P.L. 86-36 


( mcL TO USA. rvcv) [ 


NSA notified the Congressional intelligence 


committees about unauthorized disclosures of classified NSA-related information! 


classified information on 
affected agencies. A copy of the notification is enclosed. 

E. (U) Other Notifications 


Inotified t he committees about the unauthorized disclosure of 
A final security review has not been completed by all 


(b) (1) 

(b)(3)-P.L. 86-36 


(S//NF) NSA has notified the Attorney General of Qintelligence-related collection activities for 
U.S. person hostage cases. 


I. (U) Substantive Changes to the NSA/CSS 10 Program 


(U) Nothing to report. 

IV. (U) Changes to NSA/CSS Published Directives or Policies Concerning 
Intelligence, Counterintelligence, or Intelligence-Related Activities and the 
Reason for the Changes 


(U) Nothing to report. 

V. (U) Procedures Governing the Activities ofDoD Intelligence Components that 
Affect U.S. Persons (DoD Directive 5240.1-R, Procedure 15) Inquiries or Matters 
Related to lO Programs 


(U) Nothing to report. 


TOP SCCRET//COM]f-rT//NOrORN 
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